What's stopping the downloaded script from wiping my home directory?
What's stopping any Makefile, build script, or executable from running rm -rf ~
? The correct answer is "nothing". PPAs are similarly open, things are a little safer if you only use your distro's default package sources, but it's always possible that a program will want to be able to delete something in your home directory, so it always has permission.
Containerized apps are the only way around this, where they get their own home directory.